Recovery codes: eight one-time codes issued on create/admit/staff create and after every staff password reset; redeem on Forgot password with School ID + User ID + code → new password.
Delegated reset: Secretary may reset any school user except Admin; Teachers may reset Student/Parent only in classes they own (timetable or class teacher - no all-classes fallback).
UI: Forgot password dual mode; credentials dialog shows codes; Secretary and Teacher Password help screens gated by system.password.reset.